CVE-2025-14293: 
WordPress vulnerability analysis and mitigation

CVE-2025-14293 is an Arbitrary File Read vulnerability in the WP Job Portal plugin for WordPress, affecting all versions up to and including 2.4.0. The flaw exists in the downloadCustomUploadedFile function and allows authenticated attackers with Subscriber-level access or higher to read arbitrary files on the server. It was published on December 11, 2025, with a CVSS v3.1 base score of 6.5 (Medium) (Wordfence, Red Hat CVE).

The root cause is a Path Traversal flaw (CWE-22) in the downloadCustomUploadedFile function within the plugin's custom field model (modules/customfield/model.php). The function fails to properly restrict file paths to an intended directory, allowing an attacker to supply a crafted file path that traverses outside the web root and reads arbitrary server-side files. Exploitation requires only a low-privileged authenticated session (Subscriber level), with no user interaction needed and low attack complexity (Wordfence, WP Plugin Trac).

Successful exploitation allows an authenticated attacker to read the contents of arbitrary files on the server, including sensitive configuration files such as wp-config.php (which contains database credentials), /etc/passwd, application secrets, and other confidential data. This high confidentiality impact could enable further attacks such as database compromise or lateral movement, though integrity and availability are not directly affected by this vulnerability (Wordfence, Red Hat CVE).

No public proof-of-concept exploit code or evidence of active in-the-wild exploitation has been reported as of the time of disclosure. The EPSS score is approximately 0.04%, indicating a currently low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. However, the low privilege requirement (Subscriber-level) lowers the barrier for exploitation on sites with open user registration (Wordfence).

1. Reconnaissance: Identify WordPress sites running WP Job Portal plugin version ≤ 2.4.0 using tools like WPScan or by checking the plugin version in publicly accessible readme files.
2. Account Registration: Register or obtain a low-privileged WordPress account (Subscriber level or above) on the target site, which may be possible if user registration is open.
3. Authenticate: Log in to the WordPress site with the low-privileged account to obtain a valid session cookie or nonce.
4. Craft Malicious Request: Send an authenticated HTTP request to the downloadCustomUploadedFile function with a path traversal payload (e.g., ../../../../wp-config.php or /etc/passwd) as the file parameter, targeting the vulnerable endpoint in the WP Job Portal plugin.
5. Exfiltrate Sensitive Data: Retrieve the server response containing the contents of the targeted file, extracting credentials, API keys, or other sensitive configuration data for use in further attacks (Wordfence, WP Plugin Trac).

• Network: Authenticated HTTP requests to WP Job Portal endpoints containing path traversal sequences (e.g., ../, %2e%2e%2f, ..%2f) in file-related parameters; unusual outbound data transfers from the web server.
• Logs: WordPress or web server access logs showing requests to the downloadCustomUploadedFile function with suspicious file path parameters referencing files outside the plugin's upload directory (e.g., wp-config.php, /etc/passwd).
• File System: No direct file system artifacts are expected from read-only exploitation, but evidence of subsequent credential use (e.g., unauthorized database logins) may indicate successful exploitation.
• Process/Application: Unexpected database connections or authentication attempts using credentials stored in wp-config.php following suspicious file read activity.

Users should update the WP Job Portal plugin to a version beyond 2.4.0, which contains the fix for this vulnerability. As an interim workaround, site administrators can disable the plugin until a patch is applied, or restrict user registration to prevent untrusted users from obtaining Subscriber-level accounts. Monitoring web server logs for path traversal patterns in requests to WP Job Portal endpoints is also recommended (Wordfence, Wordfence Weekly Report).

Wordfence disclosed the vulnerability as part of their weekly WordPress vulnerability report for December 8–14, 2025, noting the patch availability in versions beyond 2.4.0. No significant broader media coverage or notable researcher commentary beyond the initial disclosure has been identified (Wordfence Weekly Report).